What is SASE?

Secure access service edge (SASE) is a network architecture framework that converges wide area networking and security into a single cloud-delivered platform. Rather than routing traffic through a centralized infrastructure for inspection and policy enforcement, SASE delivers those capabilities at the edge — closer to where users and applications actually are.

The term was coined by Gartner analysts in their 2019 research, but the problem it addresses had been building for years. As enterprise environments became more distributed and cloud-dependent, the limitations of traditional network security architecture became increasingly difficult to work around. SASE emerged as the structural response to those limitations.

Why traditional architecture stopped working

Legacy network security was built around a straightforward assumption: traffic flows into the corporate network, gets inspected at a central point and then reaches the user. That model worked when users were in offices, applications were in data centers and the network boundary was clearly defined.

That environment no longer describes most enterprises. Users connect from home networks, branch offices and public WiFi. Applications live in SaaS platforms and multi-cloud environments. Data moves constantly across systems that no single perimeter controls. Forcing all of that traffic back through a central inspection point creates two problems simultaneously: it cannot provide consistent security coverage and it degrades performance in ways that frustrate users and encourage them to find workarounds.

SASE resolves this by moving security enforcement to the cloud edge, where it can meet users and applications where they are rather than requiring traffic to travel to where the infrastructure is.

What SASE actually combines

SASE is built on the convergence of two distinct capabilities: SD-WAN and security service edge (SSE).

SD-WAN provides the networking foundation. It uses software to manage and optimize traffic across wide area networks, ensuring that connectivity is efficient and that high-priority application traffic is routed appropriately regardless of where the user is connecting from.

SSE is the cloud-delivered security layer. Rather than relying on traditional office-based firewalls, SSE moves security controls into the cloud, closer to users and applications. It includes secure web gateways that filter internet traffic, cloud access security brokers that govern SaaS application usage, firewall-as-a-service capabilities and Zero Trust network access controls that verify identity before granting access to specific applications.

Beyond securing internet and SaaS traffic, SASE platforms also provide secure access to private applications without exposing them to the public internet.

Together, SD-WAN and SSE form a unified platform that handles both connectivity and security through a single cloud-delivered service. That convergence is what distinguishes SASE from earlier approaches that bolted security tools onto networking infrastructure without integrating them.

What changes for enterprise security teams

The most immediate operational change SASE introduces is consolidation. Organizations that previously managed separate tools for web filtering, firewall management, remote access and cloud security governance can replace that collection of point products with a single platform. Policy is managed centrally and applied consistently across all users and locations rather than being configured separately for each tool and each site.

The second change is coverage consistency. In a traditional architecture, a user connecting from a branch office or a home network may receive different levels of protection than a user on the corporate network, because enforcement depends on where traffic is routed. In a SASE model, protection follows the user. The same security policy applies regardless of location, device type or which application is being accessed.

The third change is scalability. Adding a new branch location or supporting a rapid increase in remote users does not require hardware deployment. It requires configuration. That flexibility is particularly valuable in environments where the workforce is distributed and the footprint changes frequently.

How SASE relates to Zero Trust

SASE and Zero Trust are complementary but distinct. Zero Trust defines the security model: continuous verification of identity, device and context — with the principle that no user, device or application should be trusted by default. SASE provides the cloud-delivered architecture that enforces those policies consistently across users, devices and locations at scale.

Zero Trust network access is one of the core SSE components within a SASE platform, which means that adopting SASE creates a natural foundation for Zero Trust implementation. Organizations that are building toward a Zero Trust architecture and evaluating SASE as a delivery model are often addressing both goals through the same investment.

Who SASE is designed for

SASE is most relevant for organizations with distributed workforces, significant cloud application dependency or multiple branch locations that require consistent security coverage without the operational overhead of managing site-by-site infrastructure. For enterprise organizations managing complexity at scale, it represents a meaningful shift in how network security is designed, delivered and sustained. 

While powerful, SASE may be less applicable for smaller, centralized environments with limited cloud usage and minimal need for distributed access, where the added architectural shift may not justify the investment.

For a broader view of how SASE fits within a modern enterprise security strategy, see our SASE guide.